DEPARTMENT OF HOMELAND SECURITY 

Office of Inspector General 



Audit of DHS' Corrective Action Plan 
Process for Financial Reporting - 

Report No. 4 




OIG-07-29 



February 2007 



Ojfice of Inspector General 



U.S. Department of Homeland Security 

Washington, DC 20528 




February 16, 2007 



Preface 



The Department of Homeland Security (DHS) Office of Inspector General (OIG) was established by 
the Homeland Security Act of 2002 {Public Law 107-296) by amendment to the Inspector General 
Act of 1978. This is one of a series of audit, inspection, and special reports published by our office 
as part of our DHS oversight responsibility to promote economy, effectiveness, and efficiency within 
the department. 

This report is the fourth of a series of OIG performance audit reports on planned DHS corrective 
actions to improve internal control. Improving internal control is a critical objective of the DHS 
Financial Accountability Act {Public Law 108-330). The report is based on interviews with 
employees and officials of relevant agencies and institutions, direct observations, and a review of 
applicable documents. We contracted with the independent public accounting firm KPMG LLP to 
perform the audit. KPMG is responsible for the attached auditor's report and the conclusions 
expressed in it. 

The recommendations herein have been discussed in draft with those responsible for 
implementation. It is our hope that this report will result in more effective, efficient, and economical 
operations. We express our appreciation to all of those who contributed to the preparation of this 
report. 
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KPMG LLP is pleased to submit this performance audit report related to several of the United 
States Coast Guard's finanical improvement activities. The activities were designed to address 
material weaknesses reported in the Department of Homeland Security's (the Department) 
independent auditors' report included in the fiscal year 2005 Performance and Accountability 
Report. Our audit included an evaluation of: 

• The integrity of four Corrective Action Plans (CAPs) - Entity-Level Controls, Financial 
Reporting, Fund Balance with Treasury, and Actuarial Liabilities updated as of 
September 30, 2006. 

• How well five contractor support plans align to address material weaknesses related to 
financial system improvement, project management, internal control policy development 
and testing, and financial reporting review and generally accepted accounting principles 
(GAAP) compliance. 

• The status of the Financial Management Transformation and CFO Audit Remediation 
Plans defined in the memorandum dated July 3, 2006, from Commandant Thad Allen to 
CG-8. 

This performance audit is the fourth of a series of performance audits that the Department's 
Office of Inspector General has engaged us to perform for fiscal year 2006. This performance 
audit is designed to meet the objectives identified in the Background, Objectives, and Scope 
section of this report. 

We conducted this performance audit from October 10, 2006 to November 3,2006, in accordance 
with Government Auditing Standards, issued by the Comptroller General of the United States. 
The purpose of this report is to communicate the results of our performance audit and the related 
findings and recommendations. 
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Since November 3, 2006, we have not performed any additional procedures with respect to this 
performance audit and have no obligation to update this report or to revise the information 
contained herein to reflect events occurring subsequent to November 3, 2006. 

The Department's Office of Inspector General has authorized this report to be sent electronically 
for the convenience of the Department. However, only the final hard copy of our report should be 
deemed our work product. 



Executive Summary 



Objective 

The Department's Office of Inspector General (OIG) requested a performance audit to evaluate 
the United States Coast Guard's (Coast Guard) development of four CAPs, the alignment of 
contractor support activities to the resolution of material weaknesses in financial reporting, and 
the status of the development of a strategic plan for financial management transformation, as 
directed by the Commandant's Intent Action Order #5 (the Order) dated July 3,2006. 

Overview 

The Coast Guard undertook a number of activities, including the development of CAPs, 
engagement of contractors, and issuance of internal directives, in an effort to resolve material 
weaknesses in financial reporting. 

The Coast Guard has drafted four CAPs to address material weaknesses in financial reporting 
related to Entity-Level Controls, Financial Reporting, Fund Balance with Treasury, and Actuarial 
Liabilities. The Department deems these CAPs to be critical steps towards its objective of 
obtaining an unqualified audit opinion on its consolidated financial statements, as well as on its 
internal controls over financial reporting. The CAPs were developed in the final months of fiscal 
year 2006 by the respective process owners and were to include the identification of root causes 
of the material weakness, key success factors, key performance measures, verification and 
validation, risks, and resources requirements. 

Additionally, to assist in the implementation of the CAPs and the resolution of the material 
weaknesses, the Coast Guard awarded five contracts in August 2006 and September 2006, as 
follows: 

• Deloitte Consulting, LLP (Deloitte) for project management and financial management 
support services. 

• Okoye & Associates, LLC (Okoye) for internal control policy development and test plan 
development for compliance with internal control over financial reporting. 

• PricewaterhouseCoopers, LLP (PwC) for financial reporting assistance, assistance in 
policy development, and compliance with guidance and regulations such as generally 
accepted accounting principles (GAAP), Federal Managers Financial Integrity Act 
(FMFIA), and Federal Financial Management Improvement Act (FFMIA). 

• Global Computer Enterprises, Inc. (GCEI) for financial system audit remediation support 
focused on financial system security [two contracts]. 

Finally, Commandant Allen issued the Commandant's Order, which directed the establishment of 
a team to plan for transformation of the Coast Guard's financial management organization into a 
model of excellence. Accordingly, in July 2006, the Coast Guard chartered the Financial 
Management Transformation Task Force (FMTTF) with providing short-term win plans and a 
long(er)-term strategic plan of action and milestones (POAM) to advance the goal of earning 
sustainable, clean audit opinions. 
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Approach 



Our assessment of the integrity of the Coast Guard CAPs (as of September 30,2006) focused on 
an evaluation of the following CAP elements: 

• Identification of the underlying root cause(s) 

• Development of an effective remediation plan 

• Accountability for establishing and successfully implementing the CAP 

• Validation of the successful implementation of the CAP. 

The CAPs were the subject of three previous performance audits. Accordingly, we considered the 
revisions made to them since the last performance audit. 

Our assessment of the contracts focused on how well they aligned with efforts necessary to 
resolve the Coast Guard's material weaknesses. Specifically, we reviewed the methods used in 
developing the performance work statement (PWS) and their relationship to the material 
weaknesses. 

With respect to the Commandant's Order, our assessment focused on the identification of 
activities taken in response to the Order (six actions). However, the timing of our review 
coincided with the commencement of activities resulting from that order, and therefore, the 
intended outcomes of the execution of the Order have not yet been fully achieved. 

Our performance audit did not assess whether the CAPs, contracting actions, or actions taken in 
response to the Commandant's Order will resolve the respective material weaknesses. 

Summary of Key Observations 

During the course of the performance audit, we observed some underlying elements that were 
common among all objectives. Those elements are described below. Additional observations 
specific to a particular area of the performance audit are included within the Background, 
Findings, and Recommendations sections of this report. 

Coordination of Efforts 

The Coast Guard did not effectively coordinate its various remediation activities. It appears that 
the development and update of the CAPs, the development of the PWSs for the contracts, and the 
POAM were done concurrently and independent of each other. The activities were not adequately 
coordinated to form a single cohesive/comprehensive plan. In addition, there does not appear to 
be a single point of authority to coordinate the integration of remediation efforts and provide 
strategic oversight of each of these endeavors to help ensure that plans are coordinated and efforts 
are not duplicated. 

For example, both the CAP process owners and the FMTTF performed a root cause analysis. 
However, the work products of the FMTTF have not been integrated into the revised CAPs. In 
another example, the FMTTF has created/will create short-term plans to resolve select material 
weaknesses. These plans were described as supplements to the CAPs; however, these plans have 
not been included in the revised CAPs. 
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Coast Guard management believes that the remediation of the material weaknesses will require 
completion of the action steps contained in the short-term plans, the milestones included in the 
CAPs, and the steps outlined in the long-term plan (the POAM). To reduce the likelihood that 
efforts are duplicated or that gaps do not exist in the plans, efforts will need to be coordinated and 
integrated. 

Root Cause Analysis, Plan Development, and Verification/Validation 

The CAPs and the FMTTF POAM would benefit from detailed definitions and process-level 
analysis (e..g., A- 123 analysis) of the underlying root causes of the material weaknesses. While 
these plans identified high-level "causes", they have not fully contemplated an assessment of the 
business processes and information systems that drive the transactions/activities giving rise to the 
material weaknesses. Implementing corrective actions without first determining whether all 
significant deficiencies affecting management's ability to support their financial reporting have 
been identified may risk missing some of the deficiencies and their underlying cause(s) and result 
in potential wasted time. For example, the Coast Guard has planned to adopt the "TSA general 
ledger platform" as part of the resolution to the Financial Reporting material weakness. Without a 
thorough analysis to determine all of the deficiencies and limitations of the current general ledger, 
the Coast Guard risks implementing a "solution" that may not resolve all deficiencies and thus the 
related material weaknesses. 

In addition, the Coast Guard has not defined procedures to assess the effectiveness of its 
remediation activities. The CAPs, contracts, and POAM did not contain activities for validating 
the effectiveness of the plans. While the plans did include goals, tasks, and milestones, they did 
not include an evaluation process to determine whether the material weaknesses have been 
resolved. However, the Coast Guard did indicate that such a process would be developed by their 
contractors. 

Contract Oversight 

The Coast Guard requires human resources to effectively execute and provide oversight for the 
execution of remediation activities. The Coast Guard is constrained both by low head count and 
by the lack of personnel with deep financial management and project management experience and 
capabilities. For example, although the Coast Guard has established overall accountability for the 
CAPs at a senior level, they have not assigned accountability for specific tasks at a detailed level. 
Coast Guard management stated that the resources to perform/oversee these tasks are currently 
not available. Furthermore, the shortage of qualified staff, including a designated leader, is 
impairing the Coast Guard's ability to continue the transformation efforts of the FMTTF. As a 
result, the Financial Reengineering team is not fully fielded to assist with carrying out FMTTF 
activities/actions. 

In response to these resource constraints, the Coast Guard has turned to contractors to assist in the 
remediation efforts. While the use of contractors helps alleviate the resource constraints, there 
appears to be an inadequate number of experienced and trained government staff to oversee the 
work. For example, the oversight of the estimated 150 contractors in the Financial Systems 
Division is shared among six Coast Guard staff. In addition, the government personnel providing 
oversight for the contracts do not have the credentials or experience in financial management 
oversight of complex organizations to direct or evaluate the quality of the work provided by the 
contractors. 



Summary of Key Recommendations 



During the course of the performance audit, we formed several recommendations related to our 
observations above. Additional recommendations specific to a particular area of the performance 
audit are included within the Background, Findings, and Recommendations sections of this 
report. Specifically, the Coast Guard should: 

Coordination of Efforts 

1) Develop a consolidated and comprehensive plan for all remediation activities and/or integrate 
the plan with other internal control assessment and remediation initiatives (e.g., OMB 
Circular A- 123). The remediation plan should include: 

• The incorporation of the POAM, the CAPs, and all subsequent actions performed to assist 
with remediation planning to form a single unified plan for all efforts and determine 
whether any current efforts, to include Lean Six Sigma implementation, should be 
continued, curtailed, or stopped. 

• Work breakdown structures for each root cause once they are identified and validated. 
The work breakdown structures should include a detailed set of activities that include the 
process-level activities that must be addressed to resolve the issue, the individuals 

responsible for implementing the activities, the level of effort required by each individual 

to implement the activities, and detailed timelines with intermediate milestones for 
monitoring and reporting on work completed. 

2) Identify a designated Coast Guard "owner" or senior-level executive (e.g., DCFO) 
responsible for integrating and coordinating all financial management and reporting 
improvement initiatives. The owner should implement a process for integrating the contractor 
support efforts, FMTTF activities, and CAP updates. Such coordination and integration is 
needed to avoid duplicating remediation efforts and for reducing the likelihood of costly 
contract modifications. 

Root Cause Analysis, Plan Development, and Verification/Validation 

3) Utilize existing contract support to review the identification of root causes for the CAPs and 
the analysis prepared to support the development of the remediation plans. The Coast Guard 
should develop detailed crosswalks for mapping root causes, related audit findings, and 
recommendations to address each material weakness. Further, the Coast Guard should 
undertake an independent validation and verification to determine whether the root causes 
listed in the CAPs are complete and adequately aligned to address the material weaknesses. 

4) Develop a risk-based approach for prioritizing activities and establishing the critical paths for 
resolving identified weaknesses. The Coast Guard should use materiality or business-risk 
analysis methodologies to identify high-value areas and prioritize efforts (e.g., use materiality 
to determine financial statement line items to take action in the near term). 

Contract Oversight 

5) Implement the navigational dashboard being developed by the PMO to standardize the 
reporting and tracking functions and define the criteria for evaluating percentage to 
completion of CAP activities. 
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6) Ensure that resource requirements are identified, aligned, and in place to implement the 
CAPs. This will require the Coast Guard to ensure that all resource requirements are either in 
the budget for hiring or provided to the appropriate human resources personnel for rotations 
or reassignments within the Department. Alternative staffing models should be used in the 
near term until resources have been secured. Example alternative staffing models could 
include the use of detailees and/or long-term rotational assignments of Coast Guard or 
Department personnel. 

7) Provide Coast Guard personnel to oversee contracting efforts, evaluate work products, and 
monitor compliance with the SOWs. The Coast Guard must assemble an adequately trained 
and credentialed government staff that is sufficient in size to supervise all contractor 
performance. The staff should have the requisite knowledge and experience to direct and 
evaluate the quality of contractor work products. 

Background, Objectives, and Scope 

Background 

Office of Management and Budget (OMB) Circular A- 123, Management's Responsibility for 
Internal Control, states "Federal agencies are subject to numerous legislative and regulatory 
requirements that promote and support effective internal control. Effective internal control is a 
key factor in achieving agency missions and program results through improved accountability. 
Identifying internal control weaknesses and taking related corrective actions are critically 
important to creating and maintaining a strong internal control infrastructure that supports the 
achievement of agency objectives." 

OMB Circular A- 123 builds upon the internal control framework within the Standards for 
Internal Control in the Federal Government (Green Book), issued by the U.S. Government 
Accountability Office (GAO), which defines internal control as "an integral component of an 
organization's management that provides reasonable assurance that the following objectives, 
effectiveness and efficiency of operations; reliability of financial reporting; and compliance with 
applicable laws and regulations are being achieved." 

Ten material weaknesses associated with internal controls were reported in the Department's 
independent auditors' report included in the fiscal year 2005 Performance and Accountability 
Report. The Department has undertaken an initiative to develop and implement a formal CAP 
process. Under this initiative, the Department has issued guidance and has deployed a Web-based 
software application, Electronic Program Management Office (ePMO), to manage the collection 
and reporting of CAP information for the Department and its components. Under this initiative, 
the Department's intent is to develop effective CAPs and position itself to move forward in its 
objective of obtaining an unqualified audit opinion on its consolidated financial statements, as 
well as on its internal controls over financial reporting. 

The first key milestone in the Department's CAP process required all components to develop 
CAPs for each material weakness and to submit them for input into ePMO by the Department's 
Office of the Chief Financial Officer (OCFO) by May 31 ,2006. The second key milestone was to 
submit revisions of the revised June 30, 2006, CAPs by July 12, 2006. Additionally, beginning in 
July 2006, each CAP was required to be updated within ePMO by the last day of each month. 



The September 30,2006, CAPs were used as the basis of our performance audit. 
Objectives 

This performance audit has three main objectives: (1) assess the integrity of the CAPs, updated as 
of September 30, 2006, related to 4 of the 10 material weaknesses that were cited in the 
independent auditors' report; (2) evaluate the alignment of 5 contracts awarded to support actions 
to correct specific material weaknesses; and (3) evaluate the Financial Management 
Transformation and CFO Audit Remediation task force activities taken in response to the 
Commandant's Order issued July 3,2006. 

Our performance audit was conducted in accordance with Government Auditing Standards, issued 
by the Comptroller General of the United States, specifically, the standards for performance 
audits. 

Scope 

The scope of our work included evaluating the integrity of the following CAPs updated as of 
September 30,2006: 

• Entity-Level Controls 

• Financial Reporting 

• Fund Balance with Treasury 

• Actuarial Liabilities 

Additionally, the scope included an assessment of how well the following contractor support 
plans aligned with efforts necessary to resolve the Coast Guard's material weaknesses: 

• Deloitte, for project management and financial management support services 

• Okoye, for internal control policy development and test plan development 

• PwC, for financial reporting review and GAAP compliance review 

• GCEI, for financial system audit remediation support [two contracts] 

Finally, our scope included a review of the FMTTF activities to assess if milestones had been met 
as outlined in the Commandant's Order. 

Our scope did not include procedures on any of the CAPs associated with any of the other 
material weaknesses cited in the Department's fiscal year 2005 independent auditors' report. 
Furthermore, our performance audit did not address the outcomes achieved as a result of the 
execution of the CAPs, contracting actions, or Commandant's Order, or the status of the material 
weaknesses. 

The timeline for this performance audit was as follows: 

• Field Work - October 1 0,2006 through November 3,2006 

• Draft Report - November 1 7,2006 

• Final Report - January 1 7,2007 
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Performance Audit Approach 



Our methodology consisted of the following four-phased approach: 
Phase I - Project Initiation and Planning 

We met with personnel from the Department's OIG to discuss the scope, timeline, and deliverable 
associated with the performance audit. After the OIG meeting, we held a kick-off meeting with 
various Coast Guard personnel and contractor representatives to review the objectives, scope, and 
timeline of the performance audit. 

Meetings were scheduled with the CAP process owners, Coast Guard representatives supporting 
the contractor support plans, and the FMTTF. 

Phase 11- Assessment of Process and Related Guidance 

Interviews: 

• We interviewed personnel from the Coast Guard on their understanding and 

implementation of the CAPs as of September 30, 2006, including, but not limited to, the 

root cause analysis performed, the critical milestones chosen for measurement, and the 

mechanisms used to monitor progress in meeting the milestones. 

• We also interviewed Coast Guard personnel about their understanding and 
implementation of the contractor support plans, including, but not limited to, the 
development process and the alignment of the contracts to the material weaknesses. 

• Additionally, we interviewed Coast Guard personnel about their understanding and 
implementation of the Financial Management Transformation and CFO Audit 
Remediation Plans outlined in the Commandant's Order, including, but not limited to, 
their approach for identifying short-term and long-term remediation activities/plans. 
Finally, we interviewed the independent auditors regarding NFRs issued in connection 
with the fiscal year 2005 and 2006 independent auditors' report. 

Documentation Reviews: 

• We reviewed the CAPs, including both the detail and summary report, contained within 
ePMO and supporting documentation underlying the CAPs. 

• We also reviewed the contractor support plans and supporting documentation (i.e., PWSs, 
project plans). 

• Additionally, we reviewed the Commandant's Order dated July 3, 2006, and supporting 
documentation from the FMTTF. 

• Finally, we reviewed the NFRs issued in connection with the fiscal year 2005 and 2006 
independent auditors' report. 

Phase 111 - Analysis 

We reviewed the Department's Corrective Action Plan Process Guide (CAP guide), relevant 
NFRs, work group charters, Department CAP workshop memorandum, and existing internal 
control monitoring guidance (e.g., OMB Circular No. A-123 and CAP guides published by other 
Federal agencies) for practices that would serve as our evaluation criteria. We then compared our 
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understanding of the Department's existing CAPs to these practices to identify potential areas for 
improvement. These findings reflect situations that could negatively impact the Department's 
remediation of the material weaknesses if additional corrective action is not taken. 

We categorized the areas for improvement into one of the four broad phases generally found in an 
effective CAP analysis: 

• Identification of the underlying root cause is an important action step in the CAP process. 
Accurate identification of the root cause mitigates the chances of recurrence. Often, 
merely the symptoms of the deficiency are identified rather than the root cause. By 
identifying only the symptoms, it is difficult to develop an effective CAP that will 
successfully resolve the deficiency. 

• Development of an effective remediation plan is an appropriate way to cure an internal 
control deficiency. A key component of an effective plan is the inclusion of both 
attainable and measurable milestones to allow both the Department and the component to 
monitor the remediation process effectively. 

• Accountability is vital to the CAP process because it necessitates the establishment of an 
individual CAP owner who is responsible for its successful implementation. The owner's 
responsibilities include helping to ensure that milestones are achieved and that the 
validation phase is completed. 

• Validation is important in order to verify that the CAP has been successfully completed. 
The CAP should include activities that will provide evidence to support the closure of the 
CAP. These activities should include documentation reviews, work observations, and 
performance testing. 

For the contractor support plans, we reviewed the statements of work for each of the five 
contracts and compared them to the material weaknesses to determine if the contracts were 
structured in a way that promotes CAP development and/or refinement. We also reviewed the 
manner in which the contracts were developed and the oversight responsibilities for the 
contractors. We categorized the areas for improvement into three categories: 

• Development of an effective PWS for the contracts. This is essential to the success of the 
project plan. Defining objectives, tasks, deliverables, and milestones are key for 
effectively outlining the work and monitoring progress. 

• Accountability over contractor work efforts. Accountability is central to the contract 
process, as it establishes an individual who is responsible for overseeing the work of the 
contractors. 

• Validation of the quality of the work performed by the contractors. 

With respect to the Commandant's Order, we reviewed the subsequent charter of the FMTTF and 
compared it to the actual activities of the task force to determine that a team was identified and 
tasked with leading the process being developed for resolving the material weaknesses. The 
review also included determining the degree of oversight established to oversee the 
implementation of short-term solutions identified in the plan. We also considered the timeliness 
of the deliverables outlined in the charter. 
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Phase IV- Reporting 



After conducting our analysis in Phase III, we formulated our findings and recommendations for 
each potential area of improvement identified. 

Background, Findings, and Recommendations 

Background information and our findings and recommendations related to the four CAPS, five 
contracts, and activities performed by the FMTTF are provided below. 

Corrective Action Plans 

The Coast Guard has drafted four CAPs to address material weaknesses related to Entity-Level 
Controls, Financial Reporting, Fund Balance with Treasury, and Actuarial Liabilities. The 
September 30,2006, CAPs were used for this review. 

Background 

In response to the fiscal year 2005 independent auditors' report, the Coast Guard developed CAPs 
to assist with implementing process and systems improvements covering Entity-Level Controls, 
Financial Reporting, Fund Balance with Treasury, and Actuarial Liabilities. 

KPMG met with senior Coast Guard management concerning the CAP development process. In 
each case, with respect to root cause identification, the process included internal workshops and 
management-level discussions to identify the root causes of the material weaknesses. The Coast 
Guard relied heavily on first-hand organizational knowledge to identify root causes and develop 
the CAPs. During the root cause identification process, the NFRs relating to material weaknesses 
of the respective CAPs were considered; however, they were not the primary drivers for root 
cause identification. 

In the area of remediation plan development, the CAP process owners developed plans that were 
based primarily on intra-office collaboration and Department-sponsored workshops. The CAPs 
have been updated several times based on input received from the GAO tool (a summary of 
internal control activities) and internal review meetings. 

In the area of accountability, long-term success of the four CAPs is dependent on obtaining the 
necessary resources. Although the CAP process owners have identified initial resource estimates 
required for implementing the CAPs, the necessary government resources are not secured. This is 
impairing the Coast Guard's ability to assign accountability at the milestone/operational level of 
the CAPs. 

With respect to validation, formal plans to test and validate the activities of the four CAPs have 
not been established or developed. Coast Guard management indicated that validation plans 
would be developed for the four CAPs with the assistance of contractors. 

Findings 

To evaluate the integrity of the CAP, we reviewed the root cause identification process, the 
development process for the remediation plans, assessed whether accountability had been 
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established, and whether a validation assessment (evaluation process) was included. During the 
course of the performance audit, we made the following observations and findings. 

Root Cause Identification 

Ongoing root cause identification continues to reveal weaknesses in the initial root cause 
exercise that was performed to draft the CAPs. There was no evidence provided that a formal 
analysis to include walkthroughs of business processes and related systems was performed to 
identify all deficiencies or validate known or perceived deficiencies. This type of analysis 
would be necessary to evaluate the integrity or completeness of the root cause identification 
exercise used to create the CAPs. The principal determinant of root causes has been first-hand 
organizational knowledge by respective Coast Guard personnel, including CG-8 and FINCEN 
personnel. 

We could not determine whether the fiscal year 2006 NFRs have been considered in the CAP 
update process. Supporting system reviews, interviews, or surveys were not used in the root 
cause identification process, which could have assisted the CAP owners with understanding 
the process-level issues that are leading up to the root cause. 

For the CAPs we reviewed, it remains difficult to determine if all conditions of the material 
Weaknesses have been identified and whether the root causes that have been identified are 
adequate to assist management with developing effective remediation plans. 

Financial Reporting CAP - Multiple root causes directly contribute to weaknesses in financial 
reporting. While the CAP has identified some of the issues that resulted in NFRs, they need to 
go much deeper to address system coding flaws and other contributing causes. For example, 
the transition from the DAFIS System to the Oracle System was not identified as an 
overarching issue (the processes used to migrate data and the transitioning of systems was not 
identified as a contributing factor), but appeared to be a significant root cause. 

Fund Balance with Treasury CAP - Similarly, the Coast Guard should continue to explore the 
drivers underlying the issues with the Fund Balance with Treasury. For example, 
understanding "why" Coast Guard business processes and accounting are resulting in 
transactions posted to suspense accounts that cannot be supported will assist the Coast Guard 
with targeting the root causes of the problem and developing comprehensive remediation to 
clear suspense transactions timely and properly. 

Actuarial Liabilities CAP - The root causes do not appear to address the process-level issues 
that are contributing to systemic data problems and reconciliations. For example, the Coast 
Guard is not effectively executing a process to validate personnel and medical expenditure 
data prior to providing it to the actuary, thus negatively impacting the resulting actuarial 
calculations. Without a thorough analysis of business processes and related systems, the Coast 
Guard risks not identifying all of the problems and causes and, consequently, efficient 
resolution of the material weaknesses. 

Entity-Level Controls - While the Coast Guard has identified the need for qualified and 
trained personnel to establish a culture in which financial management is a priority, it has not 
fully identified the corresponding organizational structure or financial management oversight 
responsibilities or processes. 
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Development of the Remediation Plans 

Coast Guard management did not consider business risks, materiality, or cost versus benefit 
analysis when developing the remediation plans. This level of analysis could assist 
management with targeting higher-risk areas and prioritizing activities. The plans include 
high-level work breakdown structures but not resource estimates for each subtask of the 
milestones or a formal process for reporting progress against each CAP's milestones. The 
Coast Guard did not have detailed work breakdown structures below the major milestone 
level available for our review. Critical milestones appear to have been identified for each 
CAP; however, specific implementation steps/activities have not been assigned to each 
milestone. We were informed that this level of detail related to milestone development is in 
the planning stage. Without formal work breakdown structures for its CAPs, the Coast Guard 
does not have visibility into the assignment of process holders to the level of effort required to 
monitor, implement, and report progress. 

The availability of qualified government resources continues to be a factor for the Coast 
Guard's inability to develop detailed plans and implement CAP activities. With respect to the 
Entity-Level Controls (Financial Management) CAP, senior CG-8 management indicated that 
the Department has no "bench strength" or available personnel to assist with overseeing and 
implementing the CAP, including policy efforts in the office. Likewise, the Financial 
Reporting CAP is currently being enhanced using contractor support, with particular emphasis 
placed on remediation plan development. For the Fund Balance with Treasury CAP, resource 
requirements for executing the CAP at the top level have been identified (resources required 
but not on hand), but not at the task level. 

Accountability 

For the four CAPs, accountability for all areas, including accountability below the process 
owner level, has not been fully determined. Coast Guard management indicated that resources 
remain deficient for CAP implementation, and we could not determine whether any of the 
full-time government personnel positions included in the CAPs have been placed in the 
budget or have been identified within the Department. Long-term success of the four CAPs is 
dependent on obtaining the necessary resources for oversight and implementation. We were 
informed that if the human resources identified in the CAPs are not in place, the plans are at 
risk and the timelines will require re-baselining. 

Validation 

The Coast Guard has not defined procedures to assess the effectiveness of its remediation 
activities. The four CAPs do not contain plans for validation or verification that the respective 
work is effective. While goals, tasks, and top-level milestones were outlined, the evaluation 
process to measure progress was not evident. 
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Recommendations 

With respect to all four CAPs, the Coast Guard should: 
Root Cause Identification 

1) Validate the existing CAP root cause analyses. The Coast Guard should utilize existing 
contract support to review the identification of root causes for the CAPs and the analysis 
prepared to support the development of the remediation plans in coordination with A- 123 
implementation efforts. This effort should assist in determining whether additional root 
causes exist, and in validating that the current CAPs are adequately aligned to address the 
material weakness and include the necessary steps to implement the CAPs. To develop 
remediation plans effectively, the Coast Guard must understand and identify the process 
and system-level factors that are contributing to the material weakness. Understanding 
the problem at the process/system level should assist with developing remediation plans 
and with establishing evaluation criteria for determining whether the plans are addressing 
the root causes and are properly aligned to correct the material weakness. 

2) Develop crosswalks to ensure all conditions leading to identified material weaknesses are 
tracked to the root causes. 

Development of the Remediation Plans 

3) Update the current work breakdown structures for the remediation plans after the root 
cause analysis and validation efforts are completed. Future updates to the work 
breakdown structures should be coordinated with the PMO to ensure all remediation 
efforts are integrated. The updated work breakdown structures should include the 
individuals responsible for implementing the activities, a detailed set of process and 
system-level activities that must be addressed to resolve the issues, the level of effort 
required by each individual to implement the detailed activities, detailed timelines with 
intermediate milestones, and methodologies for monitoring and reporting on work 
completed. 

4) Develop a risk-based plan for each of the four CAPs to prioritize tasks and assist with 
aligning resources to high-value tasks. The materiality of the financial statement line 
items to which the CAPs relate should be used as the basis for assessing risk. 

5) The CAPs should address alternatives for addressing resource constraints, such as: a) the 
transfer of other resources from departments within the Coast Guard; b) the use of 
contractors specified in terms of hours and period of performance for specific defined 
tasks, and c) the hiring of resources, including a plan to mitigate the risks of the hired 
individuals not completing sufficient training and not having sufficient logistical support 
to complete their assignments. Each of these plans should include a matrix to identify and 
prevent the duplication of contracting effort and to help ensure that such effort is aligned 
to assist the Coast Guard in addressing specific weaknesses and issues. 
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Accountability 

6) Designate a Coast Guard owner or senior-level executive (e.g., DCFO) responsible for 
the coordination of all financial management and reporting improvement initiatives. The 
owner's duties would include the integration of contractor support effort, FMTTF 
activities, and updates to CAPs. The coordination of the various CAP efforts should help 
reduce the duplication of remediation efforts and potentially eliminate costly contract 
modifications. 

Validation 

7) Undertake an independent validation and verification to determine whether the root 
causes listed in the CAPs have been adequately implemented and whether the CAPs have 
resolved the material weaknesses. 

8) Implement the navigational dashboard currently under development by the PMO to 
standardize the reporting and tracking functions and define the criteria for evaluating 
percentage to completion. 

Contractor Support Plans 

The Coast Guard has issued five contracts to assist with addressing the material weaknesses 
identified in the fiscal year 2005 independent auditors' report. The contracts covered system 
improvement (two contracts), project management, internal control policy development and 
testing, and financial reporting review and GAAP compliance. We assessed the PWS to validate 
whether the contracts considered the material weaknesses. We also reviewed the development 
process of the contract support plans for assigning accountability and providing government 
oversight. 

Financial System Contracts 
Background 

The CAS Financial System touches many of the 10 material weaknesses, and through the use 
of a Systems Audit Remediation Master Cost Sheet, the Coast Guard determined that the cost 
to remediate all the issues would total over $25 million. In order to prioritize the work, the 
Financial System Division consulted with other divisions in the Coast Guard and with the 
external auditors. From these discussions, management determined that the Financial System 
Security material weaknesses should be addressed first, reasoning that if the system lacked 
adequate security, the other functions would be irrelevant. 

To create the PWS, the Financial System Division developed a list of tasks they believed 
would address the specific deficiencies that were identified by the external auditors and 
recorded these tasks on the Systems Audit Remediation Schedule. The items were prioritized 
as described above, and prices for each task were determined with the help of the developer. 
Based on the funding allowed, the tasks at the top of the list were selected to be included in 
the PWS. Once the tasks were selected, the PWS was circulated to CG-8 leadership and to 
members of the Finance Center. Once consensus was reached, which took close to six 
months, the contracts were signed in August 2006. 



Findings 

To evaluate the development of the PWS and the relationship of the PWS activities to the 
material weaknesses, we reviewed the development process of the contracts, determined 
whether accountability had been established for the oversight of the contractor support, and 
verified that a validation assessment was included. During the course of the performance 
audit, we made the following observations and findings: 

Identification of Material Weaknesses to the Performance Work Statements (PWSs) 

While the individual deficiencies (NFRs) were prioritized and the contract was designed 
to resolve each independently, the identification of the root cause of the financial systems 
material weakness was not specifically addressed in the process of contract development. 
This condition supports the need for the root cause analysis and crosswalk described 
previously. Therefore, it is difficult to determine whether the contracts are properly 
aligned to address all deficiencies resulting in material weaknesses. 

Development of Contract Support Plans 

~~ The contracts PWS and list of priority tasks are under dispute by members of 
management, which has caused delay in the performance of the contract and may result 
in costly modifications to the contract. It was disclosed that the dispute, made by 
management members who reviewed the PWS before the contract was signed, has caused 
some of the tasks listed in the contract to be put on hold until a consensus of the task 
priorities can be reached. 

In addition, a project plan was not provided for the contract work. It could not be 
determined if a plan existed or if the contractor is using the list of tasks provided by the 
Coast Guard as the basis of the project plan. 

Accountability and Government Oversight 

Government oversight of contract performance does not appear to be adequate. The 
Division Chief and her five staff members must provide oversight of the estimated 150 
contractors in the Financial Systems Division. In addition, no formal review or approval 
process was evident in the development of the contracts. Regarding communications, e- 
mail concerning the contract content is the only documentation of management 
involvement and the only evidence of accountability to the contents of the contracts. 

Validation of the Contracts to Address Material Weaknesses 

Due to resource constraints, the Coast Guard relies on additional contractor support to 
validate the success of the contractor's remediation activities. No formal process for 
validation was evident. 
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Recommendations 

The Coast Guard should: 

1) Define specific expectations for the contracts, considering the root cause of the material 
weakness and NFRs (link conditions and consider recommendations). In addition, the Coast 
Guard should review the existing PWSs and consider modifications, if necessary, to align 
them with necessary remediation efforts. This effort should assist in confirming that the cause 
of the problem is being addressed and not just the symptoms, and should provide clear 
definitions for what needs to be done under the contract to assist with remediation efforts. 

2) Help ensure that project plans exist and are approved by the appropriate Coast Guard 
personnel for each contract. The plans should include detailed tasks and timelines for 
accomplishments. 

3) Enhance the contract development process to ensure management consensus is reached to 
preclude disputes about contract content after the contract is signed, thereby avoiding 
potentially costly contract modifications (longer periods can lead to more costly solutions). 

4) Provide adequate government human resources for the oversight and validation of contract 
Fork. Even though the contracts are fixed-price, the work must be reviewed for adequacy and 
timelines must be met according to Coast Guard standards. 

Project Management/Internal Control Development/Financial Reporting Review Contracts 

Background 

A contract for project management and financial management support services was issued by 
the Coast Guard to assist with overall project management support and for the Entity-Level 
Controls (Financial Management) material weakness. This contract was intended to provide 
oversight of the other contracts that were in development to help ensure that no overlaps or 
gaps existed between the contracts and to assist the Coast Guard with FMTTF activities. This 
contract was awarded to Deloitte on September 15,2006. 

An issue that was fundamental to many of the material weaknesses was the lack of internal 
control. A second contract was developed that addressed internal control development, 
testing, and training. In review of the PWS, it appears that the tasks were designed to address 
compliance with OMB Circular A- 123, Appendix A, Internal Controls Over Financial 
Reporting. This contract was awarded to Okoye on September 26, 2006. For this project, a 
subcontractor to Okoye is PwC. 

To address the financial reporting material weakness, a contract was developed to assist the 
preparation of many aspects of the financial reporting process; help ensure compliance with 
laws and regulations, such as FMFIA and FFMIA; adhere to GAAP; and assist in the 
development of a financial management policy. This contract was awarded to PwC on 
September 30,2006. 

To develop the contracts, the Coast Guard reviewed the deficiencies identified in the current 
and previous fiscal year audit reports and consulted with the external auditors. Members of 
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the CG-84 group determined that the Coast Guard required additional staff, organization, and 
competencies to effect the necessary changes. Members of the CG-84 group developed the 
vision and worked with the contracting office to develop the specific PWSs for each of the 
contracts listed above. The contents of the PWS were reviewed by other members of the CG- 
84 group. In addition, Resource Management (CG-83) was consulted to determine the 
resources available for the coming year. 

The oversight of the Deloitte and Okoye contracts is the responsibility of a member of the 
CG-8T organization. The oversight of the PwC contract is the responsibility of a member of 
the CG-84 organization. Moreover, Deloitte will be assisting in the oversight responsibilities 
as project manager. This oversight assistance includes reviewing the work of the other 
contractors to verify that the work complies with the strategic plans and that there are no 
overlaps or gaps in the work process. As one of the methods of observing the work of the 
other contractors, Deloitte will be attending the status meetings of the other contractors. 

Findings 

To evaluate the development of the PWS and the relationship of the PWS activities to the 
material weaknesses, we reviewed the development process of the contracts, and determined 
whether accountability had been established for the oversight of the contractor support and 
whether a validation assessment was included. During the course of the performance audit, 
we made the following observations and findings: 

Identification of the Material Weaknesses to the PWS 

While the Coast Guard has taken considerable steps to engage contractors to improve 
financial management and financial reporting business processes, the contracts lack 
specificity and direction, which increases the risks of wasting resources and failing to 
achieve intended results. In addition, since it remains difficult to determine whether all 
conditions of the material weakness have been identified through the CAP development 
process, it also remains difficult to determine if the contracts are properly aligned to 
ensure that the material weaknesses are addressed. 

Development of Contract Support Plans 

The contracts were put into effect prior to the delivery of the POAM developed by the 
FMTTF, and as a result, the contracts may need future modifications to align with the 
strategic direction of the POAM. Delaying the commencement of contract work may 
have delayed remediation of the material weaknesses; however, it may have been more 
economically prudent to align the contracts with the FMTTF strategic plan to avoid 
costly modifications to the contracts. 

Due to human resource constraints, the Coast Guard is relying heavily on contractor 
support to accomplish audit remediation tasks, including providing oversight of the 
contract work itself. Deloitte is assisting in the oversight of the other contractors to help 
ensure that goals are realistic, milestones are reached, and that industry leading practices 
are followed. Coast Guard management group personnel should be assisting Deloitte with 
these efforts. 
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There is no formal approval process and no documentation to support the approval of the 
PWS content. Documentation was limited to e-mails revealing discussion of the contents 
among its reviewers. Therefore, there was no evidence of management approval of the 
contract content. 

Modifications to contracts are not being adequately documented and approved. The 
contract for PwC has been modified through verbal agreement. The only written 
documentation of contract changes is e-mail confirmation from the contractor. The 
revisions included deleting seven of the nine original tasks in the PWS. Because the 
change was not considered to be outside the scope of the contract, it was decided not to 
incur the expense of a formal contract modification. 

Accountability and Government Oversight 

As noted for the Financial System contracts, Government oversight of contract 
performance does not appear to be adequate. The Contracting Officer's Technical 
Representative (COTR) for these contracts is assigned more oversight than is normally 
expected. Additional trained COTRs should be identified and placed in oversight roles to 
distribute the work requirements for these contracts. Inadequate oversight increases the 
risk of wasted contract resources and not achieving the intended corrective action results. 

Validation of Contracts to Address Material Weaknesses 

It does not appear that validation of the contracted work has been addressed. It is evident 
that the Coast Guard relies on contractor support to assist in the improvements to 
business processes and systems to resolve the material weaknesses. It is not evident how 
the Coast Guard will assess the success of these efforts. 

Recommendations 

The Coast Guard should: 

1 ) Continue efforts to validate the root causes of the material weaknesses as a prerequisite to 
developing the contract PWSs for remediation activities. This validation should help provide 
confidence that the causes, and not the symptoms, of the material weaknesses are being 
addressed by the contracts. 

2) Coordinate and align the contract support plans with the POAM developed by the FMTTF 
and the CAPs developed by the process owners. This should confirm that all staff and 
contractors are working toward a cohesive plan for the remediation of the material 
weaknesses. 

3) Assess the need for human capital, both in number and competency, and provide sufficient 
human resources to ease reliance on contractor support. 

4) Similar to the CAPs recommendation discussed previously, enhance the contract 
development process to ensure management consensus in reached to preclude disputes about 
contract content after the contract is signed and thereby avoiding potentially costly contract 
modifications (longer periods can lead to more costly solutions). 
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5) Obtain additional contract technical managers and ensure they have obtained the appropriate 
COTR training and certification. 

6) Validate the success of the contract work. The validation should be documented in writing by 
the Coast Guard to determine whether performance measurements are established and 
reviewed to determine the adequacy and completeness of the contract work. 

Commandant's Intent Action Order #5 (the Order): Financial Management 
Transformation and CFO Audit Remediation Plans 

The Commandant's Order directed the establishment of a team to develop a plan to transform the 
Coast Guard's financial management organization into a model of excellence, capable of earning 
sustainable clean audit opinions. 

Background 

With the assistance of consultants, the team was directed to create a plan for resolving long- 
standing material weaknesses to include short-term corrective actions and longer-term 
systemic and organizational solutions. Short-term solutions were to be implemented 
immediately, where possible. This directive was followed by a charter for its implementation. 
TEe charter specifically outlined the FMTTF, including its structure, mission, guiding 
principles, deliverables, and corresponding due dates. The deliverables included a short-term 
win plan, an analysis of the status quo, and an initial plan of action and milestones that 
includes a comprehensive review of the status quo and the recommended visionary end-state 
for the organization. 

The FMTTF began on July 17, 2006, and promptly created a list of shorl-term or "quick 
hitter" actions that could be readily implemented. For long-term strategies, the FMTTF 
researched external and internal financial requirements through the use of surveys, internal 
and external interviews, and review of the NFRs, material weaknesses, and current CAPs. 
Three different plans of action were developed and brought to an off- site meeting among 
process owners for discussion and feedback. Participants were divided into four focus groups, 
and each provided feedback on the same three strategy plans. From this, the FMTTF 
identified a primary plan option (A) and an alternative plan (B). These plans were sent to the 
participants for additional feedback. The result was the FMTTF final report, or plan of action 
and milestones (POAM). 

The FMTTF was led by a senior Coast Guard representative with leadership skills and 
financial expertise who was identified and approved by the Chief of Staff. The task force was 
composed of members from various communities of interest throughout the Coast Guard and 
contractors. 

To assess the progress of the POAM on an ongoing basis and allow adjustments to the plan as 
necessary, the Coast Guard will rely on the program management contractor, Deloitte. The 
POAM states that the contractor will utilize a "portfolio" management approach that includes 
identification of the Coast Guard's portfolio of projects and people that will execute financial 
transformation work, and development of strategies that will optimize resources and 
performance. The FMTTF developed an initial draft set of performance measures, which 
should be revised and/or expanded as the plan progresses. 



Findings 



To evaluate the activities taken in response to the Order (six actions), we reviewed the 
schedule and deliverables listed in the charter for implementing the financial management 
transformation and CFO audit remediation, and compared them to actual activities of the 
FMTTF. During the course of the performance audit, we made the following observations and 
findings: 



Action I - Group Formation 



The FMTTF was substantially staffed and functioning by July 15, 2006, with remaining 
members reporting no later than August 1, 2006. However, the duration of their 
assignments was limited and the group is now standing down. 

Action II - Contractor Support 

Though later than originally planned, the Coast Guard engaged contractor support. The 
"Big 4" consulting firm was to be in place by August 15, 2006. However, the contract 
was not executed until September 15, 2006. The support did not commence until 
~ " September 22,2006. 



Action III - Short-Term Win Plan 



The short-term win plan was completed by the July 31, 2006, due date. However, initial 
due dates for some of the items listed on the short-term win plan were not realistic. When 
asked about the past-due items, the Coast Guard explained that the initial due dates, 
which were estimated completion times, were not reasonable and needed to change. 



Action IV - Status Quo Analysis and Approach 



The FMTTF completed the project approach and status quo analysis in a reasonably 
timely fashion. The project approach and the analysis of the status quo were to be 
submitted by August 15, 2006. While the project approach was submitted by this date, 
the status quo analysis was submitted in two sections — external requirements and internal 
requirements on August 24,2006 and August 31,2006, respectively. 



Action V - Plan of Action with Milestones 



The POAM was to be submitted by October 1, 2006. However, it appears that this 
deadline was established before the level of effort to accomplish this task was 
determined. The completion date for the POAM was revised to November 9, 2006, by 
Coast Guard management. The resources required to execute the POAM are not assigned. 
After the delivery of the final report (the POAM is included within the final report) on 
November 9, 2006, the FMTTF will stand down. The POAM proposes that, in its place, 
the Financial Management Transformation organization (CG-8T) be chartered and tasked 
with completing the planning, implementing the actions identified in the POAM, and 
identifying the actions necessary to achieve and sustain clean audit opinions. The CG-8T 
organization would be made up of three teams: Financial Reengineering, Internal 
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Control, and Audit Remediation. Currently, there is only a skeleton staff in place. In 
addition, although it was suggested by the FMTTF that the Coast Guard Deputy Chief 
Financial Officer should lead the new CG-8T organization, this position is currently 
vacant. Therefore, there is neither a leader nor sufficient staff to carry the POAM 
implementation forward. 

Action VI - Leadership and Stakeholder Awareness 

Coast Guard Leadership Team/FMTTF briefings were held regularly and the FMTTF 
activities and progress were noted in Coast Guard-wide e-mails. The POAM was 
developed with the assistance of stakeholder surveys and focus groups. The Coast Guard 
took actions to increase leadership and stakeholder awareness through these briefings and 
meetings. 

Recommendations 

The Coast Guard should: 

1) Secure adequate human resources to complete the planning and to implement the actions 
identified in the POAM, as well as to identify actions necessary to achieve and sustain clean 
audit opinions. Further, the CG-8 team should be led by an individual with sufficient 
leadership skills, financial expertise, and the authority to implement changes. 

2) Document in writing any changes to directives, whether in tasks or due dates, and include the 
written approval by the appropriate authority or authorities. Although documentation in 
briefings and dashboards indicate that Coast Guard leadership may have been aware of the 
delays, it does not indicate their approval. 

3) Ensure that the POAM is integrated with the CAPs. To ensure that efforts are not duplicated 
or that gaps do not exist in the plans, all activities, timelines, and schedules need to be 
coordinated and integrated. 
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MEMORANDUM 
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Reply to 
Attn of: 



CG-84 

CAPT D. L. Hill 
202-372-3610 



To: Mr. David Zavada 

Assistant Inspector General for Audit 
Department of Homeland Security 

Subj : FEEDBACK ON DRAFT PERFORMANCE AUDIT NR. 4 REPORT 

1 . Thank you for the opportunity to comment on your draft performance audit report related to 
several of the Coast Guard's financial improvement activities. In general, we concur with the 21 
recommendations contained in the report. In fact, as a result of our efforts ongoing at the time of 
the audit and since completed in several areas, we have already taken aggressive action on many 
of the recommendations. We've conducted several briefs to the DHS CFO, DHS IG staff and the 
DHS IG during the last month, all of which reflected some of the corrective action 
accomplished: 

a. Integration of our corrective action plans and Financial Management Transformation 
Task Force (FMTTF) plan of action and milestones; 

b. Development of additional milestones to expand root cause analysis; 

c. Development of risk-based, prioritized milestones and associated tasks to aid in 
sequencing and funding initiatives; and 

d. Assignment of initial resources to begin executing the FMTTF plan of action and 
milestones - now an integrated set of initiatives and related milestones. 

2. I have three comments on the findings outlined in the report that I recommend you consider 
before going final with the report: 

a. Page 3, under Coordination of Efforts: I do not agree with the statement that "the Coast 
Guard did not effectively coordinate its various remediation activities." While it is true that our 
FMTTF efforts began after we initiated our CAP activities earlier in the spring of 2006, we 
realized at the outset that our CAP process needed to be an integral part of developing the 
FMTTF's plan of action and milestones. As such, CAP owners participated extensively during 
the entire FMTTF process and the resulting POAM includes their input. Due to the timing 
differences of the two efforts, we then followed up with an extensive integration of the two 
efforts to eliminate conflicts and redundancies. As indicated in paragraph 1 above, we now have 
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a single, integrated set of milestones in place. In addition, our efforts with the contracts 
reviewed under this performance audit were an integral part of our FMTTF and CAP process. 
For example, the Deloitte performance work statement was written specifically to obtain support 
for the FMTTF and CAP efforts, and the performance requirements include specific tasks 
necessary to successfully carry out the efforts of our project management office. We have found 
their support to be invaluable, and we expect that same level of support to continue as we pursue 
execution of our integrated and comprehensive project plan. Furthermore, the Okoye and PwC 
performance work statements were written specifically to provide support for existing CAP- 
related work (i.e., internal controls and financial reporting), and we in fact have found these 
contractors' support to be especially crucial to our overall efforts now that we have integrated 
milestones in place for both of these initiatives. 

b. Page 1 1, under Root Cause Identification: While the Coast Guard recognizes that the 
root cause analysis is not yet complete in all areas, your report as written does not adequately 
reflect the extensive level of root cause analysis we've already undertaken. More specifically, it 
should be noted that at the time of this performance audit, an extensive business process and 
controls analysis had already been completed by PwC for Financial Reporting, Funds 
Management (Fund Balance with Treasury) and Entity Level Controls as part of our efforts to 
implement the DHS multi-year internal control initiative. In fact, some of the identified gaps 
were included in our 30 Sep 2006 version of the Coast Guard's CAPs. In addition, a very 
detailed gap analysis was completed by the FMTTF as part of developing the strategic plan of 
action and milestones. As indicated above, we have since integrated our CAPs and FMTTF 
efforts and have developed additional milestones to expand our root cause analysis even further. 

c. Page 17, under Accountability and Government Oversight: the statement that "The 
contract technical managers for the Deloitte, Okoye, and PwC contracts do not have Contracting 
Officer's Technical Representative (COTR) certifications and, therefore, may not be trained in 
the duties and responsibilities of this position" is not correct. The current COTR for these 
contracts is certified as such, and she is backed up with a Coast Guard subject matter expert to 
support her in carrying out her duties. Nevertheless, we acknowledge that this same COTR is 
assigned more oversight responsibilities than is normally expected. We are in the process of 
training additional COTRs and exploring other options to provide the COTR oversight resources. 

2. While we recognize the importance of root cause analysis, we also recognize the urgency of 
beginning the process of fixing known problems. The audit feedback provided in this report will 
allow us to make necessary course corrections along the way, and we're committed to working 
hard to incorporate your recommendations, especially as they relate to strategic coordination and 
contract coordination and oversight. In this vein, and with the assistance of our newly formed 
Project Management Office (PMO), we are establishing formal processes for tracking, 
monitoring and reporting the status of remediation efforts, and for providing quality control 
monitoring of completed tasks. I will provide you with more details on the PMO and quality 
monitoring procedures when I provide the more detailed narratives to back up the 
Comprehensive Project Plan milestones I forwarded to you last month. 
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3. I would be happy to meet with you to discuss our feedback. I would appreciate an 
opportunity to review the report one more time before it goes to print. In the meantime, we look 
forward to a continued strong relationship with the DHS IG and KPMG as we implement our 
multi-year financial management improvement plan. 
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